Comparing IT companies in Brisbane is harder than it should be, and the reason is that nobody scopes managed IT the same way. Two proposals for “fully managed IT support” can differ by half the work and you’d never see it from the front page.
This isn’t a ranked list. It’s what to line up side by side so the comparison means something, and the terms that decide how the arrangement feels in year two rather than in the first month.
What managed IT actually covers
Strip the brochures back and a managed IT agreement is usually four things.
A service desk. Somewhere your staff ring or email when something stops. This is the part people think they’re buying, and it’s typically the smallest share of the hours.
Proactive maintenance. Patching, monitoring, backup checks, account management, licence administration. Invisible when it works, which is why it gets cut from cheap proposals first.
Security controls. Multi-factor authentication, email filtering, endpoint protection, device management, awareness training. Increasingly the reason businesses change providers.
Advice. Someone who knows the business well enough to tell you what to spend money on next year, and what not to.
What it usually doesn’t cover, and what you should ask about specifically: projects, hardware, software licences, cabling, after-hours work, and support for your industry software beyond a first line of triage. None of those are unreasonable exclusions. They’re only a problem when you find out about them at invoice time.
The three pricing models
Almost every proposal you’ll get is one of these, and they behave very differently.
Per user, per month. You pay for people, not machines. Predictable, scales with headcount, and it stays fair when one person has a laptop, a desktop and a phone. This is the most common model for small business now.
Per device, per month. You pay for endpoints. This suits businesses with shared machines, like a workshop or a clinic where six people use two computers. It gets expensive when everyone has three devices.
Blocks of hours or ad hoc. You buy time and draw it down. Cheap when nothing is wrong, and it puts the provider’s interest exactly opposite to yours: they earn more when your systems misbehave. Fine for a very small business with simple needs, poor for anyone who can’t afford downtime.
Whichever model, ask what makes the number go up. Headcount is fine. A per ticket surcharge is worth thinking hard about, because it discourages staff from reporting the small things that turn into big things.
Read the response targets properly
“24/7 support” and “fast response times” mean nothing until they’re numbers against severities.
A workable set looks like this. Ours are: P1, where the business has stopped, 15 minutes to respond and 4 hours to resolve. P2, major disruption, 1 hour and 8 business hours. P3, a single user or something with a workaround, 4 business hours and 2 business days. P4, requests and changes, 1 business day and 5 business days.
The detail that matters is who decides the severity. If the provider classifies everything you raise as a P4, the P1 target is decoration.
Then ask about hours honestly. Our service desk runs 8am to 6pm Monday to Friday, with after-hours support available by phone at the after-hours rate. That’s a real answer. “24/7” from a small local team usually means someone’s mobile diverts, which may be fine, but you should know that’s what you’re buying.
Onboarding is the part people underestimate
The transition is where most bad experiences start. Ask for the plan, in days, before you sign.
Ours takes two weeks: discovery on days 1 to 3, findings on days 4 to 5, stabilising on days 6 to 8, then transition and documentation on days 9 to 10. The shape matters more than the exact dates. There should be a discovery phase, a point where they tell you what they found, and a documentation phase at the end.
If a provider can start Monday with no discovery, they’re planning to learn your environment from your outages.
Ask about leaving before you arrive
Nobody wants this conversation on the way in, which is precisely why it’s the one worth having.
- Who owns the documentation, and will you get a copy of it if you leave?
- Whose name is on the Microsoft 365 tenant, the domain registration and the licence agreements? The correct answer is yours.
- What notice period applies, and what does an exit handover include?
- If they’ve installed management software on your machines, who removes it?
A provider who answers these clearly is telling you something about how they operate generally.
The security baseline to expect
You don’t have to become an expert, but you should know the standard so you can tell whether a proposal clears it.
The Australian Signals Directorate’s small business guide sets three starting measures: multi-factor authentication on, software updated, information backed up. It then points at Maturity Level One of the Essential Eight, which names the eight strategies ASD rates most effective, from patching and multi-factor authentication through to application control and regular backups.
Ask any provider where you sit against it today and what Maturity Level One would take. Ask too what happens in an incident, because if you’re covered by the Notifiable Data Breaches scheme you may have to notify affected individuals and the OAIC, and you’ll need help working out whose information was involved.
Certifications are checkable, so check them. Bastion is SMB1001 Gold certified and a Microsoft Partner, and you can ask anyone for the same evidence rather than trusting a badge on a footer.
Brisbane, and everywhere north of it
For the work itself, location matters less than it used to. Patching, account management and most troubleshooting happen remotely regardless of where the provider sits.
It matters for three things: someone attending when hardware fails or a site needs cabling, working in your time zone, and knowing the local carriers and trades you’ll end up dealing with.
If you’re outside the south east, in Cairns, Townsville or the Central Queensland coast, ask two specific questions. What does a site visit cost, and how long does it take to arrange? Some providers subcontract regional attendance, which is a perfectly good answer as long as you know it’s the arrangement and who carries the responsibility when it goes wrong.
What the work actually looks like
Over the twelve months to 18 August 2026 our service desk handled 2,034 requests from 206 client businesses, and logged 774.1 hours against them. That’s an average a little under half an hour per request.
Onboarding new staff was 41 of those requests, from 21 businesses, taking 40.6 hours. Roughly an hour each, and the slow ones are always the businesses with no written process.
Two things are worth taking from those numbers when you’re comparing providers. Most managed IT is a large number of small jobs, so how quickly and cleanly a provider handles a ten minute problem matters more than how impressive their incident response story is. And the businesses that get the most out of an agreement are the ones with documented processes, because that’s what turns a three hour job into a one hour job.
How to compare two quotes
Put them next to each other and answer these for both. What’s included per user per month. What’s excluded and billed separately. What the response targets are and who sets severity. What onboarding looks like in days. What happens on exit. Where you’ll sit against the Essential Eight in twelve months.
If one is much cheaper, the difference is almost always in proactive maintenance and security controls. Ask which, rather than assuming it’s efficiency.
One thing to do before your next call: write down the last three IT problems that actually cost you money or time. Ask each provider what they’d have done about those three. You’ll learn more from that than from any capability statement.
If you’d like a second opinion on a proposal you’ve already been given, get in touch.